generated: '2026-08-04'
method: probed
status: not-published
source: live probe of https://m365-mcp.everstream.ai/mcp
notes: 'Everstream Analytics does NOT publish an MCP server over its supply chain risk data. No MCP endpoint,
  no agent tooling, and no agent documentation exists for the Reveal or Explore API.

  A real, publicly reachable MCP server does run on the everstream.ai estate at m365-mcp.everstream.ai
  — but it is a Microsoft 365 MCP relay (the root page returns the plain-text banner "Microsoft 365 MCP
  Server is running", and its protected-resource metadata advertises Microsoft Graph scopes: Mail.*, Calendars.*,
  Files.*, Chat.*, Team*, Sites.*). It is internal productivity tooling that happens to be internet-facing,
  not an agent interface to any Everstream product.

  It is recorded here so the finding is not lost, but deliberately NOT wired as a `type: MCPServer` pointer
  in apis.yml. The mcp_server_present and agent-readiness mcp_server checks mean "this provider exposes
  its API to agents over MCP"; crediting Everstream for a Microsoft 365 relay would award those points
  for something that is not their API surface.

  No candidate tool list was derived either: deriving one requires an OpenAPI to derive from, and Everstream
  publishes none.'
server:
  name: null
  transport: null
  url: null
  product_api_coverage: false
tools: []
observed_non_product_server:
  name: Microsoft 365 MCP Server
  host: m365-mcp.everstream.ai
  endpoint: https://m365-mcp.everstream.ai/mcp
  transport: http
  first_party_product_surface: false
  auth:
    gated: true
    scheme: OAuth 2.0 authorization code + PKCE (S256), public client
    authorization_server: https://m365-mcp.everstream.ai
    protected_resource_metadata: well-known/everstream-analytics-m365-mcp-oauth-protected-resource.json
    authorization_server_metadata: well-known/everstream-analytics-m365-mcp-oauth-authorization-server.json
  tools_list:
    attempted: true
    http_status: 401
    body: '{"error":"invalid_token","error_description":"Missing or malformed Authorization header"}'
    note: Live tool schemas require an authenticated introspection; no anonymous tool list is published.
      No llms.txt tool list exists to fall back to.
  paths_probed:
  - path: /
    method: POST
    status: 404
  - path: /mcp
    method: POST
    status: 401
  - path: /sse
    method: POST
    status: 404
  - path: /message
    method: POST
    status: 404
gaps:
- No MCP server over Everstream supply chain risk data.
- No agent skills, no llms.txt tool list, no agent card.
x-evidence:
  fetched: '2026-08-04'
  discovery: host found via certificate transparency (api.certspotter.com, everstream.ai + subdomains)
deployment:
  mode: none
  verified: derived
  checked: '2026-08-12'
  source: catalog MCP census